CVE-2013-7048 OpenStack Nova live snapshots use an insecure local directory
LowCVSS 3.3
EPSS 0.48%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenStack Compute (Nova) Grizzly 2013.1.4, Havana 2013.2.1, and earlier uses world-writable and world-readable permissions for the temporary directory used to store live snapshots, which allows local users to read and modify live snapshots.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi nova(PyPI) | < 12.0.0a0 | 12.0.0a0 |
| debian/nova(Debian:12) | < 2013.2.2 | 2013.2.2 |
| debian/nova(Debian:13) | < 2013.2.2 | 2013.2.2 |
| debian/nova(Debian:14) | < 2013.2.2 | 2013.2.2 |
| OpenStack Nova | >= 2013.1, <= 2013.1.4 | No fix listed |
| OpenStack Nova | >= 2013.2, <= 2013.2.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- bugs.launchpad.net exploit patch third-party-advisory
- github.com product
- RHSA-2014:0231 third-party-advisory vendor-advisory
- [oss-security] 20140113 [OSSA 2014-001] Nova live snapshots use an insecure local directory (CVE-2013-7048) mailing-list third-party-advisory
- pypi.org product
- github.com vendor-advisory
- Debian Security Tracker CVE-2013-7048 vendor-advisory
- bugs.debian.org issue-tracking